Physical Security with Kiwi Syslog Server and Cisco Router/Switch syslogging

This is something I've been working on the last few weeks.  We've run Kiwi Syslog Server forever, but have never done anything with it other than collect logs. I decided to try and implement some physical security measures using the reporting functionality of Kiwi Syslog Server.

Statements in bold are specific Cisco commands.  I'm not going to give away the farm, but I can direct you towards what I use.

I'm not going to say this is the best way to do this.  I just saying this is what I've done.

First assumption: you already have syslogging turned on and working.

Good.  Got that done?  It can be troublesome, but skipping past that.

Second, you ought to have some sort of scheme as to how you have everything plugged into your routers and switches.  Let's hope you already have that.

That 65 hour project done?  Good.  Moving on.

The purpose of having the first two things done is so you can limit the length of the exclusion list on your Syslog Server.   There are always some oddballs, but those can be accounted for without too many exclusions in the list.

I hope you also have hostnames that identify the device decently.  That makes writing the catch statements easier.  I call them catch statements, but really that is inaccurate.  They are text based filters.

What I've learned about writing these filters is you need to be simplistic in filter design.  You can have up to 100 different filters per action, so don't try and filter a complex statement in one filter.  Use multiples.  For example, I have one filter built that limits to switch traffic.  Should I need to write anything else that is based solely on switches, I can then copy that one filter and know I'm now working only on switches.

For physical security on switches, any unused port is in a shutdown state.  All other ports use MAC address sticky.  Because they use MAC address sticky, I alert on any time there is a port-security violation. So within two minutes of plugging in a cable to the switch, I'm aware.

For routers, I'm aware of what ports should be used.  I then monitor all router ports for up/down states.  So, should you plug into a router, the syslog will see the port status change and alert.  That can then be correlated with DVRs in the store to identify who plugged in, and with the port status down message, you get an indication of how long the person was plugged in.

The other option is to have the router ports shutdown as well.   Depending on the day, I can lean either direction.  

If you are going to leave the ports on, you need to be physically blocking them off with a tamper sticker.  I'd almost say use a tamper sticker anyways.

As for all the other port up/down messages, I would run those though whatever network analytic software you use.

I'm sure there are better ways to do physical security.  Locked rooms, locked doors, and cages come to mind.  But operationally, that's not always possible.   So you have to work with what you've got.  And despite being critical to operation, people who build buildings generally don't want to dedicate an entire lockable room to things that aren't sold out the front door.

Active Directory and Content Adviser part 2

Found a solution to the problem I talked about the last post.  The answer was use a proxy server.  The proxy server is actually a file pointing to the local host with a bit of scripting involved that either returns the outside interface "proxy server unavailable".  Which works out pretty well, because you get the effect of blocking the Internet.  The proxy file is located on a read-only network share, and is copied to the computer whenever the user logs in.  So even if the Internet goes down, you still have the old proxy file.  And when the Internet comes up, you get the latest, greatest version.

That seems to work a lot better in theory than content adviser.  And for some reason I want to spell adviser as "advisor".  Anyways.

The hard part was need to rebuild the IE auto-install to get the proxy settings into the Internet Options control panel, and turning off Content Adviser.  That required removing the computer from the domain, use "Turn Windows Features On and Off" to remove and re-add IE 11 with none of the IEAK options set.  The rejoin the domain, and then the IEAK version to have the proxy file working and in place.

The great benefit of this approach is the proxy file works with Chrome as well.

But there are certain programs we use that are hard coded to use Internet Explorer, so there's no option of permanently going away from that.

Yay.   Now all I have to do is get the logon script working properly, and everything will be great.  Did I mention I'm deploying the computer Monday afternoon?

My Active Directory learning was from this book: Windows Server 2008 Active Directory Configuration.

Active Directory makes me something something....

Been working on Windows Server 2008 Active Directory automatic installation.  All I want to do is use automatic installation of IE 11 with a specific Content Adviser set.  But no.   When I update Content Adviser using the IE Automated Installation Kit, it doesn't update Content Adviser.  It doesn't even install.

Great.

Back to beating on the same problem.

Introduction to Networking Chapter 3 notes

Chapter 3 notes from Introduction to Networking

Network protocols and communication

Rather than adopt new standards and rebuilding the wheel, the network industry has developed a framework

-use of accepted models

All communication has 3 elements

-sender or source

-receiver or destination

-channel, the medium over which the message travels

transmission governed by protocols

-specific to type of communication

protocols necessary for effective communication

-specific to characteristics of communication method

-must be followed to be successfully delivered and understood

-identify sender and receiver

-common language and grammar

-speed and timing of delivery

-confirmation of acknowledgement requirements

Network protocols define

-message encoding

-msg formatting and encapsulation

-msg size

-msg timing

-msg delivery options

message encoding

-process of converting into another form for transmission

decoding - reverse of encoding; used to interpret

message formats

-depend on msg

-channel

if destination address and formatting wrong, then msg is not delivered

-computer format called a frame

frame acts like an envelope

message size

-large messages broken into smaller

message timing

access method- where you can send

flow control - how much and how fast

response timeout - reaction according to no answer

rules of communication

message delivery options

1 to 1 - unicast

1 to many - multicast

1 to all - broadcast

protocol suite - a group of interrelated protocols necessary to communicate

visualized as a stack

lower layers - transmit data

upper layers - focused on content

application protocol

transport protocol

internet protocol

network access protocol

standards organizations

-open standards encourage competition and innovation

-prevent monopoly 

-standards organizations write rules in order to maintain an open internet

-vendor neutral

-non-profit includes ISCO, IAB, IETF, IEEE, ISO

ISOC - promotes open development

     -evolution

     -world wide use

IAB - responsible for overall management

     -development of standards

     -oversight of architecture and protocols

IETF - develop, update maintain internet and TCP/IP technologies

     -produce RFC

IESO - technical management of the IETF

IRTF - focused on long term research

IEEE - wide range of standards

     -wireless

     -MAC for wired ethernet

ISO - created OSI model

EIA - electrical wiring, rack size

TIA - electrical wiring, cell tower, VOIP

ITU-T - video compression, IPTV, broad band communications, DSL

ICANN - coordinate  IP Address allocation

     -domain names used by DNS

     -TCP/UDP protocol/port number

IANA - handles ICANNs job of 

     -IP address allocation

     -domain name management

     -protocol identifiers

TCP/IP and OSI model

-layered model used to help visualize interaction between layers

benefits of layered model

-assists in protocol design

-fosters competition

-prevents different layer changes from affecting other layers

-provides common language for network functions/capabilites

Two types of model

protocol model - closely matches structure of a particular protocol suite

     -represents all functionality required to interface human network with data network

reference model - provides consistency within all types of networking protocols and services

     -describes the what, not the how

OSI model                    TCP/IP Model

-----------------------------------------------------

Application

Presentation               Application

Session

-----------------------------------------------------

Transport                       Transport

-----------------------------------------------------

Network                         Internet

-----------------------------------------------------

Data link

Physical                         Network access

OSI model designed by ISO

TCP/IP model deployed faster, so that it is what has been used

OSI model has specific functions at all layers

7.  Application Layer - means for end to end connectivity between individuals in the human network using data networks

6. Presentation layer - provides a common representation of the data transferred between application layer services

5.  Session Layer - Provides services to the presentation layer to organize its dialogs and to manage data exchange

4.  Transport Layer - defines services to segment, transfer, and reassemble the data for individual communications between the end devices

3. Network Layer - provides services to exchange individual pieces of data over network between end devices

2. Data Link Layer - method for exchanging data frames between devices over common media

1.  Physical Layer - Decribes mechanical, electrical, functional, and procedural means to activate, maintain, and deactivate physical connections for bit transmission to and from a network device

TCP/IP model (AKA Internet model)

defined by RFC

     -contains technical and organizational documents

Application - represents data to the user, plus encoding and decoding control

Transport - supports communication between diverse devices across diverse networks

Internet - determines best path through the network

Network Access - controls hardware devices and media that make up the network

TCP/IP model is described in terms by the OSI model

     -network access layer doesn't specify which protocols to use when transmitting

     -only describes hand off

Data Encapsulation

segmentation - divide data into smaller, manageable, chunks

benefits - many conversations interleaved on the network

     -increase reliability of the transmission

     -more complex

     multiplexing - interleaving the pieces as they traverse the media

data at any layer a PDU (protocol data unit)

data - application layer PDU

segment - transport layer PDU

packet - network layer PDU

frame - data link layer PDU

bits - physical layer PDU

data encapsulation - process of adding headers and trailers before transmission

deencapsulation - occurs at end devices

OSI model describes processes of encoding, formatting, segmenting, and encapsulating data for transmission over the network

network address - 

     -contains layer 3 information required to deliver IP packet from source to destination

L3 address has 2 parts 

     -network prefix

     -host part

     network prefix used by routers to forward packet to the proper network

     host part used by routers to forward packets to the proper network

     host part used by last router to deliver to final destination

a L3 IP packet contains 2 addresses: source, destination

Data link address

L2 physical address - used to deliver from one network interface to another network interface on the same network

on Ethernet, L2 physical address know as MAC or BIA (burned in address)

     -48 bits

How does a host find MAC address?

     uses ARP (address resolution protocol)

     1) sending host send ARP request; broadcast to entire LAN

     2) all devices examine the broadcast to see if it contains its own IP address

     3) destination IP address device responds with ARP reply.  ARP reply contains associated MAC address

Access remote network

     1) sender determines destination is not in network

     2) sends to default gateway

     3) repeats 1 & 2 until reach destination

Information Density

I spent most of the last couple of days studying Cisco Introduction to Networks material.  The chapter on IP addressing was incredibly dense.  I ended up taking 25 pages of written notes during the entire thing.

I think what I learned from all of it is the future of the Internet is in the hands of two distinctly different people with distinctly different goals.  One wants unlimited access to everything and no security.  The other wants security.

There was a time when the Internet was time when the Internet was this wild, woolly place of hope and adventure.  It was the great playground of intellectuals and only those in the know could manipulate the world.  Which was great in theory, but not in practice.  Eventually you ran into a human problem, not a technology problem.

I guess it narrows down to the simple fact that people want to get paid for their work.  And the other group believes the Internet should be a free trading ground of ideas.  I think both ideas are capable, but designing the Internet towards one or the other is short-sighted.

From a security standpoint, the argument is that  with IPv6, you should use normal router and device hardening techniques and that should be fine.  That idea was designed by someone who never had to protect a network, or anything for that matter.  Security wise, you should always design for security in depth.  There should be multiple, complimentary levels of security.  Combining router hardening with NAT and PAT, VLANs, VPNs, network obfuscation and no DHCP pool and you've got the beginnings of security.  I said beginnings, because each technology has its failings.

It's a big blue marble out there, and a lot of cooks with different plans make for an interesting mix.

No Blog is a Bad Blog

A Day late and a dollar short, here.  I'm behind on pretty munch everything, which is why typing all this on a phone is kind of nicer. I can drag a blog out of myself where ever I happen to be.  

I've taken a few pictures for something I'm thinking of about running cable. A Modest Mouse song about a long walk off a short pier keeps running through my head.   

Then my wife was telling me something about a $100 bottle of wine, and I could think about was an Entreleadership podcast with Seth Godin.  In that episode, he was discussing story telling and selling by pointing out that there isn't a wine out there where the cost of production alone justifies the high cost.  If it only costs $5 to produce, then $100 wine doesn't make sense unless there is something else involved.

The other thing running through my head right now is one of Murphy's rules for combat.   I found the document some time before the invasion in 2003, and it was pretty accurate.  One of the statements was:

If you are low on eveyrthing except the enemy, you are in combat.

Yeah, seems pretty accurate.  

Cisco Introduction to Networks chapter 2 notes

Chapter 2

Configuring a network operating system

Router - forwards packets to and receives data packets from the Internet

switch - connects end devices using network cables

wireless access point  -consists of a radio transmitter capable of connecting end devices wirelessly

firewall appliance - secures outgoing traffic and restricts incoming traffic

operating system enables the hardware to function

Cisco Internetwork Operating System (IOS)

IOS  - generic term for the collection of network operating systems used on Cisco networking devices

kernel - portion of the OS code that interacts directly with hardware

shell - portion of the OS code that interacts with user and applications

user can interact with the shell through command line interface (CLI) or graphical user interface (GUI)

purpose of IOS

     security

     routing

     QoS

     Addressing

     managing resources

     interface

Accessing Cisco IOS

     -console

     -telnet/SSH

     -Aux port

Console - outbound access - access via a dedicated channel for maintenance only

     -available without configured networking services

telnet - remote access through a virtual interface over a network

     -requires active networking on the device

     -can also access any other devices via a built-in telnet client

     

SSH - secure shell - similar to telnet, but uses encryption

     -stronger password authentication

     -encrypts transmission

     -requires active networking on the device

AUX - access via telephone dial-up

     -requires no networking services to be set up

     -can be used locally

Navigating IOS

     user exec mode >

     privileged exec mode #

     global config (config)#

     specific config modes       (config-if)#

                                          (config-line)#

     user exec mode >

          -view mode

          -basic operations

     privileged exec mode #

     

     global configuration mode - change device as a whole

> enable/disable

#configure terminal

to leave modes -> exit or ctrl-Z

command structure

switch> ping 192.168.31.1

prompt  command   space  keyword/argument

switch> show ip protocols

bold - type as shown

italics - supply value

Cisco IOS command reference

help forms

     context-sensitive

     command syntax

     hotkeys and shortcuts

     context-sensitive - provides a list of commands within the current context -> ?

     

     command syntax check

     -parse left to right

     -generally only provides negative feedback

          3 types of error

          -ambiguous command

          -incomplete command

          -incorrect command

Hotkeys and shortcuts

     ctrl+shift+6  ->break sequence

     tab -> finish command

     ctrl+C -> interrupts entry and exits config mode

commands

     show - display various information

     show version - display version info, system uptime, restart info

Getting Basic

Hostnames

     switch requires no configuration to function

     hostname - unique device name

     -provide info about network setup

     -remove ambiguouity

     -should be used in network documentation

     -create naming convention

     -apply using CLI

Limiting access to a device

     physical limitations - behind closed doors, in a rack

     device passwords 

     

     enable password - limit access to priviledged exec mode

     enable secret - same as enable password, but encrypts the password

     console password - limit device access using password

     VTY password - limit access via telnet

     (config)# enable secret password

console security

     

     #line console 0

     #password ***

     #login      <- apply="" div="" login="" password="" the="" to="" used="">

VTY security

     

     -most switches have 16 VTY lines number 0 through 15

          #line vty 0 15

     #password ***

     #login     <- div="" login="" on="" password="" require="">

     #service password encryption

     -applies weak encryption to all passwords when viewing configuration files

     -removing command doesn't remove encryption

 banner configuration

      -should never show "welcome" type message, or encourage access

     motd - message of the day

     #banner motd #   message goes in here #

          -The # symbols are message start, end characters

          -delimiting characters

          -can be any character

          -can't be in the message presented

          -motd showed when anyone accesses the system

saving configurations

     -running config reflects current operational configuration

     -unsaved changes removed at reboot

          #copy running-config start-config

     

     #reload    ->reboot system and restore to startup-config

eliminating startup-config

#erase startup-config

#erase NVRAM:startup-config

must also delete vlan file to return to factory out of box status

#delete vlan.dat

Backup configuration with text capture

#show running-config

copy/paste into a text file.  Have to clean up file before importing back into a system

Address Schemes

Ports & Addresses

IPv4 (Internet Protocol, version 4) uses dotted decimal notation

     -4 numbers between 0 and 255

     -subnet mask also required

IP Addresses assigned to physical ports and virtual interfaces 

     -virtual interface - no physical hardware associated with the interface.

Addressing Devices

Remote access requires IP address and subnet mask

#interface vlan 1

#ip address XXX.XXX.XXX SubnetMask

ex...   #ip address 10.75.20.254 255.255.255.0

#no shutdown      <- and="" disable.="" div="" enabled="" ever="" port="" set="" t="" to="" won="">

Addressing End Devices

depends on device

     -must have IP address,

               subnet mask

               default gateway

     -default gateway is IP address of the way out of the network

     -DNS server (domain name system)

          translate IP addresses to web addresses

     -IP addresses can either be configured manually or automatically using DHCP

     Dynamic Host Configuration Protocol

     Show IP info in windows using 

     ipconfig

     ipconfig /all

testing the loopback

     loopback adderss is 127.0.0.1  <-reserved address="" div="" ip="">

     ping failure indicates problem with system

          -drivers

          -NIC

          -TCP/IP implementation

Verifying connectivity

     #show ip interface brief

use ping to verify end to end connectivity